Question

A security review at a financial services company reveals that many members have been granted broad predefined roles like roles/editor on production projects, but most only use a small subset of permissions. Leadership wants a data-driven, ongoing process to safely reduce these members to least privilege without breaking active workloads. Which Google Cloud approach best meets this requirement?

Accepted Answer

Use IAM Recommender to review policy insights and recommendations based on 90-day usage data, and apply the suggested smaller roles for over-permissioned members.

Answer

Replace all predefined roles with a single custom role that contains every permission any member might need, then assign it project-wide.

Answer

Remove all IAM bindings and re-grant access manually as each member files a support ticket requesting specific permissions.

Answer

Apply an organization policy constraint that blocks the use of the roles/editor role across all projects.